Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2026-83999HIGHWindows Resilient File System (ReFS) Deduplication Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-27458HIGHHP Hotkey Support – Escalation of PrivilegeEPSS 0.2%CVE-2025-3908MEDIUMThe configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbEPSS 0.2%CVE-2025-1697MEDIUMHP Touchpoint Analytics Service – Potential Escalation of PrivilegeEPSS 0.2%CVE-2026-76037HIGHLink following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute EPSS 0.2%CVE-2023-25940MEDIUM Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_info. A high privileEPSS 0.2%CVE-2026-12391MEDIUMubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logsEPSS 0.2%CVE-2025-43395LOWThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 2EPSS 0.2%CVE-2026-20610HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privilEPSS 0.2%CVE-2026-70626HIGHNLTK before 3.9.4 Symlink Escape via CorpusReaderEPSS 0.2%CVE-2026-43765MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.2%CVE-2025-66680HIGHAn issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files vEPSS 0.2%CVE-2024-0068MEDIUMImproper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows File Manipulation.ThisEPSS 0.2%CVE-2026-58414MEDIUMNetwork-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backupsEPSS 0.2%CVE-2025-4211HIGHImproper Link Resolution Before File Access in QFileSystemEngine on WindowsEPSS 0.2%CVE-2026-23563MEDIUMPrivilege escalation in TeamViewer DEX via DeleteFileByPath instructionEPSS 0.2%CVE-2026-35400LOWLORIS incorrectly trusts user input in publication moduleEPSS 0.2%CVE-2025-8612HIGHAOMEI Backupper Workstation Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-43379MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS EPSS 0.2%CVE-2026-42795MEDIUMSymlink Following in Hex Package Export Allows Embedding Files Outside Project RootEPSS 0.2%